Bundle Dependabot updates #551, #552, #553 into one PR #554

The three open Dependabot PRs (#551 runtime, #552 actions, #553 dev-tooling) each fail CI on their own: reviewed pins in tests (LiteLLM measured release, action SHAs), the Hatchling release build constraints, the Material 9.7.7-specific bundle override, and pytest-asyncio 1.4.1's unset-loop-scope warning (an INTERNALERROR under filterwarnings=error).

Land them together with the pin/test adaptations they need, and close the individual PRs as superseded.